Download the PHP package juvo/wp-secure-actions without Composer
On this page you can find all versions of the php package juvo/wp-secure-actions. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wp-secure-actions
WordPress Secure Actions
This library allows you to create verifiable actions with an expiration date and an execution limit. Possible use cases:
- One-time-links
- Trackable links (number of clicks)
- Slack-like magic login that authenticates a user via e-mail
- Secured download links to avoid direct file access
- Double opt-in process
Secure Actions uses its own database table to avoid further pollution and cleans up after itself.
Installation
Simply instantiate the Manager class as early as possible by adding the following snippet to your functions.php or an early executed plugin file:
Secure Actions will take care it is only loaded once. It will automatically register the cleanup cron job and default URL handling process.
Usage
| Parameter | Type | Description | |
|---|---|---|---|
$name |
string |
Required | Unique name to identify the action e.g. in filters |
$callback |
string array |
Required | Callback action to execution whenever the action is triggered. |
$args |
array |
Optional | The parameters to be passed to the callback, as an indexed array. Defaults to array(). |
$expiration |
int |
Optional | Action expiration interval in seconds. Defaults to -1. |
$limit |
int |
Optional | Action execution limit. Defaults to -1. |
$persistent |
bool |
Optional | Determines if an action should be deleted when expired or limit reached. Defaults to false. |
key |
string |
Optional | Sets the given password instead if choosing a random one |
Example
Create and execute Action
This example creates an action that sends an email to users who updated their profile. In this example, the action is executed immediately, but you can execute it any time later within its expiration interval.
Use action in URL
In the following example, we are going to inform a WordPress user if his profile was updated. The user will receive an email containing a login link that automatically redirects him to the profile page. Since the callback function has no return value, the is code is not able to detect a successful execution and cannot automatically increment the counter. Therefore, we have to do it manually.
Advanced usages
Cleanup
In some cases, you want to change the cleanup functions behaviour. The following examples demonstrate how to use the secure_action_cleanup filter.
Action URL redirect
If you use the secure action URL feature, the user will be redirected to the front page after the execution. It is possible to change that behaviour by hooking into the following filter.
| Parameter | Type | Description | |
|---|---|---|---|
$url |
string |
Required | URL to redirect to. Defaults to get_site_url() |
$action |
\juvo\WordPressSecureActions\Action|WP_Error |
Optional | Action lookup result from the db. If your action exceeded some limits and is not using the "persistent" flag, this parameter will most likely be an WP_Error instance because the deletion workflow is triggered during the action execution. |
$result |
mixed |
Optional | The action´s execution result. Will most likely be an instance of WP_Error if the action exceeded some limits. |
Security
1. Key Generation and Storage:
- Unique Keys: The library generates unique keys for each action using the WordPress core function
wp_generate_password(). This ensures randomness and unpredictability for the keys, especially with a length of 28 characters. - Hashing: Before storing the key in the database, it is hashed using the WordPress
PasswordHashclass, which implements a portable PHP password hashing framework. This means the original key is never stored in plain text, further protecting against potential database breaches. - Verification: The hashed key is used for verification during the execution of actions, ensuring only the person with the original key can execute the given action.
2. Action Execution Verifications:
- Key Validity: During the execution of an action, the provided key is verified against the hashed key in the database. If there's a mismatch, the action will not proceed.
- Expiration: Each action can have an expiration time. If an attempt is made to execute the action after its expiry, the attempt will be declined, and the action will be deleted.
- Execution Limits: A limit can be set on the number of times an action can be executed. Once this limit is reached, further execution attempts are declined.
- Callback Integrity: The library ensures the callback associated with the action is callable before proceeding with the execution. This prevents potential misconfigurations or tampered callback data from causing unexpected behaviors.
3. Error Handling:
- The library returns
WP_Errorobjects in cases of execution failures, ensuring the end user gets a descriptive message about what went wrong without exposing sensitive system details.
4. Recommendations:
- Key Storage: Make sure, to never store the plain keys as they give direct access to the underlying process.
- Limit Persistent Actions: The library provides an option for actions to persist even after reaching their limits or expiration. While this can be useful in certain scenarios, it's recommended to use this feature judiciously.
